SANS Advanced Incident Response, Threat Hunting, And Digital Forensics (FOR508) Practice Test

Memory-based forensics examines the volatile data held in RAM at the moment of capture. This means looking at what is actively in use by the system and running processes: the live processes and their threads, the open network connections and sockets, the modules loaded into memory (such as DLLs and kernel drivers), and credentials or other sensitive data that reside in memory during operation. This data is transient and can disappear if the system reboots, which is why capturing a memory image is crucial for understanding the exact state of the system at that moment and for uncovering artifacts that may not exist on disk. Disk-based data sources, like disk file system metadata or imaging the entire disk, reflect non-volatile storage and file system structures rather than the current execution state of the machine. Printed documents from the case file are outside digital memory forensics and do not represent volatile artifact data.